SameSite default limits cross‑site POSTs in Chrome 80+

SameSite default limits cross‑site POSTs in Chrome 80+

Chrome 80 and newer treat cookies without an explicit SameSite attribute as Lax. This default prevents the cookie from being sent on cross‑site POST requests, a behavior that often succeeds locally on localhost but fails on production HTTPS domains.

The policy is documented in Chrome’s SameSite cookie specification, but an unresolved decision remains: should SameSite=None be allowed when the Secure flag is omitted? Allowing it would enable cross‑site cookie usage locally but could expose production sites to security risks.

Because the default can change in future releases and can be overridden by enterprise policy, developers face uncertainty when relying on the current behavior.

Unresolved questions

• What is the current Chrome policy for SameSite=None without the Secure flag in version 80+?
• Will upcoming Chrome releases modify the default SameSite value for unspecified cookies?